Static task
static1
Behavioral task
behavioral1
Sample
03697ebeddc4dc6c28375a4830b11fcf95805996ff8d1b2c81a6bd78e5a24ea5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
03697ebeddc4dc6c28375a4830b11fcf95805996ff8d1b2c81a6bd78e5a24ea5.exe
Resource
win10v2004-20220901-en
General
-
Target
03697ebeddc4dc6c28375a4830b11fcf95805996ff8d1b2c81a6bd78e5a24ea5
-
Size
3.0MB
-
MD5
259f08c8670ffefab765a8653bcb96ea
-
SHA1
e6125bf0cf554b1c61cc6f71ce002a295a6945da
-
SHA256
03697ebeddc4dc6c28375a4830b11fcf95805996ff8d1b2c81a6bd78e5a24ea5
-
SHA512
723aa9bf14bdf8028bae60c367b1e977fa229845228c704a29b04e7c0aee939e4e652bfed147758b56616be01e8937fa7922dddcf90b7e55a0498251eaa0c27d
-
SSDEEP
49152:5KaTVsmmWrx70vD00TMPMne/m2JR1TDYSxeOFshwyPw1vlBdPxJIjlggcVN1Cn15:wLDqx70voMnee2vYGFiwMwZlBt3Ij2gN
Malware Config
Signatures
Files
-
03697ebeddc4dc6c28375a4830b11fcf95805996ff8d1b2c81a6bd78e5a24ea5.exe windows x86
ebee107d65b970bdeb64e311bae9aaf5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SHGetFolderPathW
ShellExecuteExW
ExtractIconExW
ShellExecuteW
kernel32
WriteProcessMemory
LocalFree
GetTempPathW
GetProcAddress
CloseHandle
VirtualFreeEx
VirtualAllocEx
OpenProcess
CreateThread
GetExitCodeThread
GetLongPathNameW
TlsAlloc
TlsFree
TlsGetValue
DeviceIoControl
CreateFileW
GetLastError
GetVersionExW
GetVolumeInformationW
WaitForSingleObject
CreateRemoteThread
EnterCriticalSection
GlobalFree
MulDiv
SizeofResource
LockResource
LoadResource
FindResourceW
GetWindowsDirectoryW
SystemTimeToFileTime
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
InterlockedDecrement
InitializeCriticalSection
GetModuleHandleW
LoadLibraryW
GetSystemDirectoryW
GetSystemTime
WideCharToMultiByte
SetLastError
MultiByteToWideChar
lstrlenA
GetStartupInfoW
LeaveCriticalSection
Sleep
lstrlenW
GlobalAlloc
GlobalLock
GlobalUnlock
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
user32
DefWindowProcW
FindWindowW
GetWindowThreadProcessId
PostThreadMessageW
PostMessageW
CallWindowProcW
ReleaseDC
GetClassInfoExW
LoadCursorW
wsprintfW
RegisterClassExW
RedrawWindow
GetWindowDC
EndDialog
MoveWindow
SetWindowTextW
SendMessageW
GetWindowRect
GetClientRect
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
SetWindowPos
MapWindowPoints
FillRect
GetMessageW
SystemParametersInfoW
DialogBoxParamW
MessageBoxW
GetWindowTextW
SetFocus
CreateDialogParamW
PeekMessageW
ShowWindow
InvalidateRect
GetActiveWindow
UpdateWindow
DispatchMessageW
IsWindow
DestroyWindow
ScreenToClient
GetDC
HideCaret
SetWindowLongW
CreateWindowExW
GetWindowLongW
GetParent
GetWindow
gdi32
CreateFontIndirectW
CreateSolidBrush
DeleteObject
DeleteDC
GetTextExtentPoint32W
CreateFontW
GetDeviceCaps
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
IsTextUnicode
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
ole32
CLSIDFromProgID
CoUninitialize
CreateStreamOnHGlobal
CoSetProxyBlanket
CoInitializeSecurity
CoInitialize
CoCreateInstance
oleaut32
VariantChangeType
OleLoadPicture
SysAllocString
VariantInit
VariantCopy
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysFreeString
CreateErrorInfo
msvcp60
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@DABV10@@Z
??0bad_alloc@std@@QAE@ABV01@@Z
??1bad_alloc@std@@UAE@XZ
??0bad_alloc@std@@QAE@PBD@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??1?$ctype@G@std@@UAE@XZ
?id@?$ctype@G@std@@2V0locale@2@A
??_7?$ctype@G@std@@6B@
?do_is@?$ctype@G@std@@MBEPBGPBG0PAF@Z
?do_is@?$ctype@G@std@@MBE_NFG@Z
?do_scan_is@?$ctype@G@std@@MBEPBGFPBG0@Z
?do_scan_not@?$ctype@G@std@@MBEPBGFPBG0@Z
?do_tolower@?$ctype@G@std@@MBEPBGPAGPBG@Z
?do_tolower@?$ctype@G@std@@MBEGG@Z
?do_toupper@?$ctype@G@std@@MBEPBGPAGPBG@Z
?do_toupper@?$ctype@G@std@@MBEGG@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBGI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?do_widen@?$ctype@G@std@@MBEPBDPBD0PAG@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIID@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?do_widen@?$ctype@G@std@@MBEGD@Z
?do_narrow@?$ctype@G@std@@MBEPBGPBG0DPAD@Z
?do_narrow@?$ctype@G@std@@MBEDGD@Z
??1?$ctype@D@std@@UAE@XZ
??0_Lockit@std@@QAE@XZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
??1_Lockit@std@@QAE@XZ
?_Getfacet@locale@std@@QBEPBVfacet@12@I_N@Z
?_Iscloc@locale@std@@QBE_NXZ
??_7facet@locale@std@@6B@
??_7ctype_base@std@@6B@
??_7?$ctype@D@std@@6B@
??0_Locinfo@std@@QAE@PBD@Z
_Getctype
?_Cltab@?$ctype@D@std@@0PBFB
?_Term@?$ctype@D@std@@KAXXZ
??1_Locinfo@std@@QAE@XZ
??_7bad_cast@std@@6B@
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?_Doraise@runtime_error@std@@MBEXXZ
?what@runtime_error@std@@UBEPBDXZ
??_7runtime_error@std@@6B@
?_Xran@std@@YAXXZ
?_Xlen@std@@YAXXZ
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?_Freeze@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??0runtime_error@std@@QAE@ABV01@@Z
??0runtime_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?_Refcnt@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEAAEPBG@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??0locale@std@@QAE@XZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
??1ctype_base@std@@UAE@XZ
?do_toupper@?$ctype@D@std@@MBEDD@Z
?do_toupper@?$ctype@D@std@@MBEPBDPADPBD@Z
?do_tolower@?$ctype@D@std@@MBEDD@Z
?do_tolower@?$ctype@D@std@@MBEPBDPADPBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
msvcrt
fgetpos
fread
strchr
atol
localtime
_findclose
_wfindnext
_wfindfirst
modf
_ftime
??0exception@@QAE@XZ
_purecall
??8type_info@@QBEHABV0@@Z
?name@type_info@@QBEPBDXZ
??9type_info@@QBEHABV0@@Z
wcscat
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_stricmp
fprintf
fgets
fgetc
isalpha
?set_new_handler@@YAP6AXXZP6AXXZ@Z
_CIpow
_except_handler3
__CxxFrameHandler
_ftol
memcpy
wcslen
swprintf
wcschr
??2@YAPAXI@Z
strlen
strncmp
memcmp
memset
wcstol
_wcsnicmp
srand
clock
time
__p___wargv
__p___argc
??1exception@@UAE@XZ
_wcsicmp
wcscpy
fabs
wcsncpy
_wtol
_wmkdir
_wchdir
fclose
fwrite
_wfopen
_waccess
rand
_wgetenv
??0exception@@QAE@ABV0@@Z
abs
_CxxThrowException
_wtoi
_wrmdir
_wremove
_lrotr
_wfullpath
_wgetcwd
memmove
memchr
malloc
free
wcstok
_wcsdup
_wsplitpath
toupper
tolower
wcscmp
??0exception@@QAE@ABQBD@Z
sprintf
strncpy
isprint
isspace
isalnum
strrchr
fsetpos
fseek
wsock32
select
recv
send
connect
htons
ioctlsocket
gethostbyname
socket
WSAStartup
ntohl
htonl
Sections
.text Size: 412KB - Virtual size: 410KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 84KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ